Cato Networks Ltd.’s Cato CTRL threat research team today detailed a macOS attack campaign built around a fake OpenAI Codex installer.

The lure ends with the victim opening Terminal and pasting a command that runs the malware, the social engineering pattern known as ClickFix.

It begins with a sponsored Google search result for queries such as “codex macos download.” The ad sits above OpenAI Group PBC’s own listing. Clicking it leads to a page on Google Sites that copies the Codex download portal, down to the macOS and Linux buttons. Cato observed payload delivery only for macOS.

That Google Sites page carries no malicious code of its own. Attacker content loads inside an iframe, probably routed through a Google static-content proxy. The split lets the operators refresh the ClickFix content without touching the Google Sites page victims actually see.

Researchers mapped three infrastructure sets. One of them hides its own lure. The live ClickFix page sits at /codexx/, and the more obvious /codex/ path returns a harmless product page. Non-macOS visitors were served benign content too. An analyst or a scanner requesting the intuitive path may never be served the attack at all.

The fake installer walks the user through opening Terminal and pasting a command that starts with a plausible npm install string for Codex. Behind that opening, the command decodes a Base64 URL and pipes a remotely retrieved script into zsh.

Three stages follow. First comes a shell-script loader padded with dead code and unused variables, wrapped around an encoded blob that it decodes and runs through eval. The second stage comes out of that eval. Telemetry goes out before anything else, a request to an attacker endpoint carrying event=pasted, which records that someone ran the command.

The script then pulls the final payload down to /tmp/helper, .clears the file’s extended attributes with xattr -c, makes it executable and launches it. Stripping those attributes removes the download quarantine metadata that would normally put a warning in front of the user.

The loader itself has been reworked between infrastructure sets. Early samples compressed and Base64-encoded the second stage. Newer ones use an AES-encrypted gzip container and rebuild the decryption key from several variables scattered through the script.

Cato ties the delivery framework to Atomic macOS Stealer, the commodity infostealer better known as AMOS. The overlap covers the loader URL structure, the telemetry request, the staging path in /tmp/helper, the removal of extended attributes and update-themed payload URLs.

Researchers described the match as strong and consistent with AMOS delivery activity, without naming the final binary outright. That payload is a universal Mach-O, so it runs on Intel and Apple Silicon Macs.

Several campaigns tracked this year have dressed malware delivery in artificial intelligence developer tooling. Microsoft Corp. documented a related macOS ClickFix operation on Aug. 5 that had shifted from openly served lures to browser-fingerprinting gates showing malicious content only to likely targets. Cato said it has blocked the reused iframe host behind the newest Google Sites lure it found, and that it’s still watching the operators rotate domains and payload locations.

“No single stage reliably exposes the attack,” the report said. Detection, the researchers wrote, depends on correlating search delivery, embedded content, Terminal execution and outbound activity.

Image: SiliconANGLE/GPT Image 2